Privacy Policy

1. Overview

This Privacy Policy explains how Chell Brown LLC d/b/a Marketing and Sales Help ("MASH," "we," "us," or "our") collects, uses, and protects information when you use My MASH Card and related services (the "Service") available at mymashcard.com.

We are the data controller for the personal data we collect through the Service.

2. Information We Collect

We collect information in the following categories:

Account information. Your name, email address, profile preferences, time zone, and account settings, provided when you sign up or update your account.

Card information. Information you add to your digital business card(s), including your name, title, company, location, contact details (phone, email, website, LinkedIn URL), bio, value statement, profile photo, custom action links, and gallery media.

Lead information. When a person scans your card and submits their contact information through the share-back form, we store their name, email, phone, company, title, website, LinkedIn URL, and any context you record (where you met, event tag, notes, follow-up status, tags). On our Business Capture card template (used for storefronts and event booths), and on other card templates where the card owner has turned on the optional marketing opt-in setting, we also store whether the person checked a box opting in to marketing communications from you. Card owners are responsible for ensuring they have a lawful basis to capture this information and for honoring any marketing consent choices the person made.

Sync and integration data. When you connect a third-party service (Google Sheets, CRM platforms, custom webhooks, LinkedIn), we store the credentials or settings necessary to make the integration work (e.g., the spreadsheet ID for Google Sheets, the API key for your CRM). OAuth tokens for Google and LinkedIn are stored securely by our platform infrastructure and are not directly accessible to MASH.

Payment information. If you subscribe to a paid plan, we store a Stripe customer ID and subscription metadata. We do not store credit card numbers, CVVs, or bank account details: all payment instrument data is handled directly by Stripe.

Usage and analytics data. We collect aggregate information about how the Service is used, such as card view counts, contact download counts, and lead capture counts. When you visit our website, our analytics tool (Google Analytics 4) may collect your IP address, browser type, device information, and referring URL. You can opt out of analytics cookies via our cookie banner.

Communications. If you contact us for support, we retain your messages and our responses.

3. How We Use Your Information

We use your information to:

• Provide and operate the Service
• Process payments and manage subscriptions
• Send you transactional emails (account confirmations, lead alerts, follow-up reminders, briefings, security notifications)
• Send marketing emails and affiliate product recommendations: only if you've opted in (you can opt out at any time)
• Improve and develop new features
• Provide customer support
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal information.

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area, United Kingdom, or another jurisdiction with similar laws, we rely on the following legal bases:

• Contract: to provide the Service you signed up for, process payments, and send transactional emails.
• Consent: for marketing emails, affiliate recommendations, and non-essential cookies (including analytics).
• Legitimate interest: for fraud prevention, security, product improvement, and processing lead data captured through cards on behalf of card owners. You can object to this processing at any time.
• Legal obligation: for tax, accounting, and other regulatory requirements.

5. How We Share Your Information

We share information with the following third parties (our "sub-processors") only as needed to provide the Service:

We may also share your information when required by law, in response to a valid legal process, to protect our rights or the safety of others, or as part of a business transaction (such as a merger or acquisition: you'll be notified if this happens).

6. International Data Transfers

Our application data is hosted in the United States by default. If you are located outside the United States, your information will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework (where applicable) to ensure adequate protection for international transfers.

7. Data Retention

We retain personal information only as long as needed to provide the Service and meet legal obligations.

Some information may be retained longer where required by law (e.g., tax records).

8. Cookies and Tracking

We use cookies and similar technologies to operate the Service, remember your preferences, and analyze usage. You'll see a cookie banner on your first visit asking for your consent.

Strictly necessary cookies (always on): authentication, security, basic site function.

Analytics cookies (consent required): Google Analytics 4, which sets _ga and _ga_* cookies to measure site usage. These cookies last up to 2 years.

Third-party cookies: Stripe sets cookies during checkout for fraud detection and payment processing.

You can change your cookie preferences any time using the "Cookie Preferences" link in our website footer.

In addition to cookies, our application uses your browser's localStorage to remember small preferences (such as your filter selections and dismissed banners). localStorage data is stored on your device and is not transmitted to us.

9. Your Rights

You have the following rights regarding your personal information:

• Access: request a copy of the information we hold about you
• Correction: correct inaccurate information (you can edit most of your data directly in the app)
• Deletion: delete your account and associated data via Settings → Danger Zone, or request deletion via email
• Portability: export your lead data as a CSV file from the Lead Feed
• Object: object to processing based on legitimate interest
• Restrict processing: pause certain processing activities
• Withdraw consent: opt out of marketing emails (link in every marketing email), revoke cookie consent (footer link), or disable integrations
• Complain: lodge a complaint with your local data protection authority if you believe we've violated your rights

To exercise any of these rights, email us at support@marketingandsaleshelp.com. We'll respond within 30 days.

If You Submitted Your Contact Info to a MASH Card

If you shared your contact information through a MASH cardholder's digital card and want to access, correct, or delete that information, email us at support@marketingandsaleshelp.com. Include the name of the cardholder you met if possible, and we'll work with you to locate and update or remove your information within 30 days.

10. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act ("CCPA") provides you with additional rights regarding your personal information.

Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information about California residents:

• Identifiers: name, email address, phone number, account credentials
• Customer records: payment information (handled by Stripe), subscription history
• Commercial information: products or services purchased, subscription tier
• Internet activity: interactions with our website, device information, IP address (via Google Analytics, subject to your cookie consent)
• Geolocation data: approximate location derived from IP address (analytics only)
• Professional information: job title, company, professional bio (information you add to your card)
• Inferences: limited, used to suggest duplicate lead flagging

Sources of Personal Information

We collect this information directly from you (when you create an account, build your card, or capture leads), automatically (when you use the Service), and from third-party services you connect (such as LinkedIn for profile import).

Business Purposes for Collection

We use personal information for the purposes described in Section 3 of this policy: primarily to provide and improve the Service, process payments, communicate with you, and comply with legal obligations.

Disclosure of Personal Information

In the past 12 months, we have disclosed personal information to the categories of third parties listed in Section 5 (Base44, Stripe, Google, LinkedIn, third-party CRM platforms, Encharge, Happierleads, and Visby AI). We do not sell personal information for monetary value.

Your California Rights

California residents have the right to:

• Know what personal information we have collected, used, disclosed, and sold
• Delete personal information we have collected, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• Limit use of sensitive personal information (we do not use sensitive personal information for purposes that trigger this right)
• Non-discrimination: we will not discriminate against you for exercising any of your CCPA rights. Exercising these rights will not result in denial of service, different prices, or reduced quality.

How to Exercise Your Rights

To exercise any of your California rights, email us at support@marketingandsaleshelp.com with the subject line "California Privacy Rights Request." We will verify your identity (typically by confirming the email address associated with your account) and respond within 45 days as required by law.

Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written proof of authorization, and we may require you to verify your identity directly with us.

"Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information for such purposes.

11. Marketing Communications

By default, we do not send marketing emails. If you opt in (during signup or in your Settings), we may send you:

• Product updates and new feature announcements
• Tips and best practices for using the Service
• (If you separately opt in) Recommendations for affiliate products and third-party tools we think may be useful

You can opt out of marketing emails any time by clicking the "unsubscribe" link in any marketing email, or by toggling off the relevant settings in your account.

Transactional emails (account, billing, security, lead alerts, follow-up reminders) are essential to providing the Service and are not affected by marketing preferences.

Marketing opt-in on cards. Card owners can optionally turn on a checkbox on their share-back form: on our Business Capture card template (for storefronts and event booths) it's on by default, and on other card templates a card owner can enable it in their card settings: that lets a visitor opt in to marketing communications from the card owner's business. This consent is given to the card owner, not to us: the card owner is responsible for honoring that choice, including providing a way to unsubscribe and complying with applicable marketing laws (e.g., CAN-SPAM, CASL, GDPR/ePrivacy) for how they use that contact going forward. We store whether the box was checked as part of the lead record; we do not send marketing messages on the card owner's behalf.

12. Automated Processing

We use automated and AI-assisted processing to:

• Flag potentially duplicate lead records based on email and phone matching
• Schedule follow-up reminders based on your settings
• Generate briefing digests summarizing your recent activity
• Generate suggested email drafts when you use our AI email assistant
• Power our in-app diagnostic agent, which can review your account activity to provide guidance
• In the future, we may use AI or OCR (optical character recognition) services to extract contact information from images you upload (such as photos of paper business cards)

When you use AI-powered features, the relevant data (such as lead information, your prompts, or uploaded images) is processed by AI service providers contracted by our platform infrastructure provider (Base44). These providers process the data only to generate the requested output and do not use it to train their models.

These automated processes do not produce legal or similarly significant effects on you. They are designed to help you stay organized and work more efficiently.

13. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has submitted information to us, please contact us and we will delete it promptly.

14. Security

We use commercially reasonable measures to protect your information, including:

• HTTPS/TLS encryption for all data in transit
• Encryption at rest for stored data (managed by our infrastructure provider)
• Row-level security controls limiting access to your data
• Secure handling of OAuth tokens through our platform's connector infrastructure

No system is completely secure. We can't guarantee that unauthorized access will never occur, but we take all reasonable steps to prevent it. If a data breach affects your information, we'll notify you and the relevant authorities as required by law (within 72 hours where applicable).

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top. For material changes, we'll notify you by email or through a prominent notice in the Service before the changes take effect.

16. Contact Us

Chell Brown LLC d/b/a Marketing and Sales Help

Email: support@marketingandsaleshelp.com